diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2023-02-06 15:42:53 +0100 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2023-02-06 15:42:53 +0100 |
| commit | e899e4edd97c296a29b2a8da2c2e3b598622c36e (patch) | |
| tree | 3a1c0f3afe381ffc7e7954fd0e2e8cc43e8a54fe /docs | |
| parent | de2077b56388c5196d5c1ddcbbd4a141ea8cf67b (diff) | |
More robust application of access permissions (#5062)
* More robust application of access permissions
We were in particular missing directory traversal `+X` in our current recommendations.
Extracted to own shell script so it can easily be invoked.
Update access permissions in Docker to account to be more robust.
#fix https://github.com/FreshRSS/FreshRSS/discussions/5037
* Minor simplification
* Restrict mkdir permissions
Default mkdir permissions are 0777, which is not good for security, so downgrade to 0770.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/en/admins/06_LinuxInstall.md | 9 | ||||
| -rw-r--r-- | docs/en/admins/07_LinuxUpdate.md | 4 |
2 files changed, 3 insertions, 10 deletions
diff --git a/docs/en/admins/06_LinuxInstall.md b/docs/en/admins/06_LinuxInstall.md index e92fc3247..1af041efe 100644 --- a/docs/en/admins/06_LinuxInstall.md +++ b/docs/en/admins/06_LinuxInstall.md @@ -81,14 +81,7 @@ Change to the new FreshRSS directory, and set the permissions so that your Web s ```sh cd FreshRSS -chown -R :www-data . -sudo chmod -R g+r . -``` - -We’ll also need to allow the data folder to be written to, like so: - -```sh -chmod -R g+w ./data/ +sudo cli/access-permissions.sh ``` Optional: If you would like to allow updates from the Web interface, set write permissions diff --git a/docs/en/admins/07_LinuxUpdate.md b/docs/en/admins/07_LinuxUpdate.md index 834dfaaef..27e8ef451 100644 --- a/docs/en/admins/07_LinuxUpdate.md +++ b/docs/en/admins/07_LinuxUpdate.md @@ -64,7 +64,7 @@ If your local user doesn’t have write access to the FreshRSS folder, use a sud 6. Re-set correct permissions so that your web server can access the files ```sh - chown -R :www-data . && chmod -R g+r . && chmod -R g+w ./data/ + cli/access-permissions.sh ``` ## Using the Zip archive @@ -91,7 +91,7 @@ If your local user doesn’t have write access to the FreshRSS folder, use a sud 5. Re-set permissions ```sh - chown -R :www-data . && chmod -R g+r . && chmod -R g+w ./data/ + cli/access-permissions.sh ``` 6. Clean up the FreshRSS directory by deleting the downloaded zip and the temporary directory |